Privacy Policy

version of December 11th, 2020

 

This privacy policy (the "Privacy Policy") sets out the manner in which we collect and process personal data, as well as the various rights that protect such data.

1/ WHAT IS “PERSONAL DATA”?

Personal data is any information relating to an identified natural person (your name is for example a personal data that identifies you directly) or indirectly identifiable (a customer number for example or the IP address of your computer if you consent to the use of certain cookies).

2/ WHAT IS OUR ROLE IN THE PROCESSING OF PERSONAL DATA?

The data controller is the person who determines the purposes and means of the processing of personal data, i.e. the person who defines the purposes for which the data is processed.

The company FLANKER SAS, registered with the Paris Trade and Companies Register (France) under number B 348 790 320 with a capital of 441 888 Euros, whose registered office is located at 10-12 rue de Mont Louis, 75011 Paris (hereinafter referred to as "EDEN PARK") publishes the website "eden-park.com" and acts as data controller.

You may at any time refer to our personal data manager: FLANKER SAS, E-commerce Department, 10-12 rue de Mont Louis, 75011 Paris, <contact@eden-park.tm.fr>.

3/ HOW DO WE COLLECT PERSONAL DATA?

We collect personal data directly from you, when you use the functionalities made available to you on the "eden-park.com" website, such as creating an account, placing an order or asking us a question.

We may also collect personal data through the use of technical cookies, either to ensure the proper functioning of the site "eden-park.com" or, if you consent, to measure the performance of the site, to provide an individualized shopping experience or personalized advertising.

Subject to applicable legal reserves (in particular Article 14 of the General Data Protection Regulation 2016/679, “GDPR”), we may collect personal data indirectly from third parties in connection with the supply or promotion of our products and services, such as payment service providers who may inform us of the non-payment of an order.

4/ IS THE TRANSMISSION OF PERSONAL DATA TO US IS MANDATORY OR OPTIONAL?

If you wish to interact with us, in particular to take advantage of our products or services, the transmission of certain personal data may be necessary.

In the forms for the collection of personal data, the personal data marked with an asterisk are obligatory in order to carry out the processing operations related to the purpose that has been defined by EDEN PARK. For example, the transmission of your name is obligatory to open a customer account, the transmission of your email is obligatory if you wish to receive our newsletter or the transmission of your address is obligatory for the delivery of an order. In the event that these fields marked with an asterisk are not filled in, EDEN PARK will not be able to carry out the actions that should normally have resulted from the transmission of this personal data (such as, for example, taking the necessary steps to deliver an order to your address).

Fields without an asterisk are optional and their failure to fill in these fields has no consequence on the possibility for EDEN PARK to implement the actions that would result from the transmission of the mandatory personal data.

EDEN PARK does not collect personal data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and personal genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning a natural person's sex life or sexual orientation or data concerning health or (apart from specific legal obligations relating to its employees).

 
5/ FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA?

In our capacity as data controller, we process personal data (beyond those related to the management of our staff) for the following purposes:

Management of your requests for information: in order to manage our responses to your requests for information, we process the personal data you provide us with in this context.

Data: identity, personal data related to the requests for information.

Legal basis: consent (expression of willingness on your part to provide us with this data for processing for response).

Duration: requests and answers are kept for two years from the last contact.

Management of our relations with our customers and prospects: in order to manage our relations with our customers and prospects, we collect personal data relevant to customer management, management of e-reservation, management of unpaid invoices and litigation, commercial statistics, prospecting and information operations with a view to prospecting and management of access, rectification and opposition rights.

Data: identity, address, email, telephone, fax, internal processing code, data relating to the monitoring of the commercial relationship (orders, contracts, customer exchanges and comments, delivery address), data relating to loyalty actions, prospecting, prospect selection, customer opinions on services, data relating to transactions, data relating to means of payment, invoices, discounts, deductions, bank data.

Legal basis (customers): such processing is necessary for the execution of a contract or pre-contractual measures.

Legal basis (prospecting): such processing is necessary for our legitimate interests to make our products and services known on the market.

Legal basis: legal obligation to manage the exercise of the data rights of the data subjects.

Legal basis: as regards the communication of your personal data to our commercial partners in order to enable them to carry out prospecting actions, prior collection of your consent.

Duration: Customer data is kept during the contractual relationship and for five years after its termination (statute of limitations). Prospect data is kept for a period of three years from the end of the business relationship or from the last contact from the prospect. In case of communication of identity documents for a request for right of access and rectification, the data may be kept for one year and three years in case of right to object. In case of payment by credit card, the retention period to serve as proof of the transaction is limited to thirteen months following the debit date.

Management of our website: we collect and process personal data relevant to the management of our website "eden-park.com" and the protection of its cyber-security.

Data: identity, functions, contact details, data relating to navigation (IP address, timestamp, cookies) and on digital platforms via share and media buttons, user contact management data, data relating to the management of technical service providers and data relating to audience and use of online services offered by EDEN PARK.

Legal basis: such processing is necessary for our legitimate interests to implement actions to monitor the operation and use of our website "eden-park.com".

Legal basis, for non-exclusively technical cookies: consent.

Duration: log data (logs) are kept six months, the data necessary for the production of audience statistics and use of online services are kept thirteen months, data exchange with service providers are kept five years after the end of the concerned contract.

Management of the fight against fraud on our website: we collect and process personal data relevant to the fight against fraud on our website "eden-park.com", using the "Fraud Expert" solution from Ingenico (our online payment provider).

Data: identity, functions, contact details, data relating to navigation (IP address, timestamp, cookies) and on digital platforms via the share and media buttons, user contact management data, data relating to the management of technical service providers and data on audience and use of online services offered by EDEN PARK, determination of a level of risk linked to a transaction, detection and management of any resulting alerts, "human" verification of transactions presenting a certain level of risk, score modelling.

Legal basis: such processing is necessary for our legitimate interests to implement anti-fraud actions on our "eden-park.com" website.

Duration: log data is kept for six months, the data necessary for the production of audience and online service usage statistics is kept for thirteen months, and data on exchanges with service providers is kept for five years at the end of the contract in question.

Communication and event management: we collect and process personal data relevant to the management of our marketing and communication events (registrations, logistical organization, evaluation, statistics) and the sending of our commercial communications.

Data: identity, contact details, projects monitored, exchanges related to the implementation of projects, statistics.

Legal basis: such processing is necessary for our legitimate interests to implement communication actions with our customers and prospects, to make our activities known.

Legal basis: such processing, when the communication actions are consecutive to the voluntary transmission of your e-mail address for the reception of newsletters, is based on your consent.

Duration: Data for the sending of newsletters are kept as long as the person concerned does not unsubscribe (which he or she can do at any time via the unsubscribe link on each e-mail), press relations data are kept for five years, event-related data are not kept for more than five years after the event in question has taken place, data on social network pages are kept for the duration of the existence of the account of the social network concerned (unless exercice of a right to erasure or to object).

Accounting: in order to comply with our various legal obligations arising from the exercise of our business activities, we process the relevant personal data for the purposes of establishing and monitoring our accounting.

Data: identity, address, bank domiciliation, information on the nature of the operations carried out, payment of invoices, fees, taxes.

Legal basis: such processing is necessary, as far as our legal obligations are concerned, to comply with these obligations (accounting conservation of invoices, establishment of financial, fiscal or accounting documents).

Duration: ten years from the end of the financial year. Beyond that, this data may be archived on a separate computer medium with authorized access.

Litigation management: we collect and process personal data relevant to the preparation, exercise and follow-up of disciplinary actions or legal proceedings and, where appropriate, for the enforcement of the decision rendered.

Data : data for the identification of defendants, victims, witnesses and court officials (surnames, first names, sex, date and place of birth, nationality, address, telephone, email), data relating to offences, convictions or security measures (disputed facts, information, documents and exhibits collected with a view to establishing the facts likely to be reproached, characteristics of litigation (statements of facts, testimonies, attestations, pleadings, procedural documents), characteristics of litigation (pleadings, bulletins, summonses, documents, court records, court decisions, acts of judicial officers), convictions, procedural follow-up.

Legal basis: such processing is necessary for the execution of a contract or pre-contractual measures, in the event of litigation related to a contract.

Legal basis: such treatment is necessary for our legitimate interests to implement our rights of defence, in the event of litigation not related to a contract.

Duration: during the litigation and after extinction of the means of appeal, then archiving in a distinct and secured support if historical interest.

Partnership management: we collect and process personal data relevant to the monitoring of partnership agreements, the implementation of joint projects, internal and external communication and the production of statistics.

Data: identity, contact details, projects monitored, exchanges related to the implementation of projects, statistics.

Legal basis: such processing is necessary for the execution of a contract or pre-contractual measures.

Duration: partners data is kept during the contractual relationship and for five years after the end of the contract (statute of limitations).

Distributorship management: we collect and process personal data relevant to the monitoring of distributorship agreements of our products, the implementation of joint projects, internal and external communication and the production of statistics.

Data: identity, contact details, projects monitored, exchanges related to the implementation of projects, statistics.

Legal basis: such processing is necessary for the execution of a contract or pre-contractual measures.

Duration: distributors data is kept during the contractual relationship and for five years after the end of the contract (statute of limitations).

Management of applications: in order to ensure the management of applications for vacant positions at EDEN PARK, we process personal data relevant to the examination and selection of applications.

Data: identity (surname, first name, address, photograph), professional data present on CVs, letters of motivation and exchanges, application interviews and interview notes, wishes formulated by candidates in terms of employment, assessment of professional skills based on objective criteria and in direct and necessary connection with the job sought.

Legal basis: such processing is necessary for our legitimate interests in integrating possible new employees.

Duration: destruction after rejection of an application or retention for two years if the candidate consents (for future vacant positions).

6/ ARE THE PERSONAL DATA WE PROCESS ACCESSIBLE TO THIRD PARTIES?

External recipients are likely to receive communication of your personal data, namely:

  • our processors (who process data on our behalf) and partners acting for logistical and technical reasons (carriers, hosting and computer maintenance providers, anti-fraud providers, e-reservation providers, store location providers, parcel tracking providers, size recommendation providers, communication sending providers, payment method providers, customer service providers, personalized partnership management providers, digital advertising providers);
  • our partners in charge of the control of EDEN PARK (auditor, services in charge of internal control procedures...);
  • organizations, court officials and ministerial officers, within the framework of their mission of debt collection or litigation management;
  • where applicable, the organization in charge of managing the opposition list to telephone prospecting.

EDEN PARK may also be required to communicate your personal data in the event of legitimate requests from public authorities, in particular to meet requirements in terms of respect for personal data law, national security, fight against fraud or more generally law enforcement.

EDEN PARK implements organizational and technical security measures adapted to the degree of sensitivity of your personal data to protect them against any malicious intrusion, loss, alteration or disclosure to unauthorized third parties.

7/ WHAT RULES APPLY TO COOKIES (COOKIES)?

A "cookie" is a small text file recorded in a dedicated space on your hard disk when you consult the "eden-park.com" site using your browser software. It allows its transmitter to identify the terminal in which it is stored, during the period of validity or registration of the cookie.

When a cookie is purely functional (storing information entered in forms, managing and securing access to reserved areas, managing an order basket), it can be used without requiring your consent.

In other cases, placing cookies on your terminal requires your prior consent. During your first visit to the "eden-park.com" site, EDEN PARK asks for your consent to the installation of cookies that are not purely functional via a banner explaining the purposes of these cookies and a system for managing your preferences. You are free to set, at any time, your possible consent or the withdrawal of your consent to the installation of cookies that are not purely functional on your terminal.

Personal data resulting from the installation of cookies on your terminal is stored for a maximum period of 13 months.

8/ ARE THE PERSONAL DATA WE PROCESS TRANSFERRED OUTSIDE THE EUROPEAN ECONOMIC AREA?

Your personal data is hosted and processed in the European Union by EDEN PARK. However, EDEN PARK may be required to call upon certain service providers located abroad or which call upon subcontractors located abroad, including outside the European Economic Area (EEA). In such a case, the transfer of your personal data outside the EEA will be carried out subject to the implementation of appropriate safeguards in accordance with applicable legislation on the protection of personal data, in particular through the signature on a case-by-case basis of contractual clauses based on the model of the European Commission or any other mechanism in compliance with the GDPR. For more information on the guarantees applicable to these transfers, you may contact: contact@eden-park.tm.fr.

9/ WHAT ARE YOUR RIGHTS ON YOUR PERSONAL DATA?

You benefit, within the limits defined by the law, from the following rights:

  • Right of access: you can obtain information on the processing of your personal data and a copy of these personal data;
  • Right to rectification: you can request the rectification of your personal data that you consider incomplete or inaccurate;
  • Right to erasure: you may request the deletion of your personal data;
  • Right to restriction of processing: you can request restriction of the processing of your personal data;
  • Right to data portability of your personal data: you have the right to have the personal data you have provided us with returned to you or, where technically possible, transferred to a third party in machine-readable form (as opposed to the right of access);
  • Right to withdraw your consent at any time if the processing is carried out on the legal basis of your consent;
  • Right to refer any possible complaint before the competent supervisory authority (see list http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm);
  • Right to define guidelines for the storage, deletion or communication of your personal data after your death;
  • Right to object: the right to object to the processing of your personal data on grounds relating to your particular situation.

 

To exercise these rights, you may:

  • directly access and/or modify your personal data by accessing the "my account" section and logging in with your password on the "eden-park.com" website;
  • or make a request, attaching a copy of proof of your identity, to one of the two following addresses: FLANKER (Eden Park), E-commerce Department, 10-12 rue de Mont Louis, 75011 Paris or contact@eden-park.tm.fr.

A response will be sent to you within a maximum of one (1) month following the date of receipt of your request. However, this period may be extended by two (2) months depending on the complexity and/or number of requests. In this case, EDEN PARK will inform you of this extension and the reasons for the postponement within one (1) month of receipt of the request.

In the event of a request for the deletion of data or the expiry of the data retention period, EDEN PARK nevertheless reserves the right to keep the data in its archives for the period necessary to meet its legal, accounting and tax obligations.

If you consider that this Privacy Policy has not been properly implemented in your respect or if you notice a violation of your personal data, we invite you to contact us (contact@eden-park.tm.fr) for any clarification or additional information.

It is reminded that a minor can, from the age of 15, consent alone to the processing of his or her personal data if it is carried out in the context of online services intended for minors. When the minor is under 15 years of age, consent must be given jointly by the minor concerned and the holder of parental authority. If this is not the case, EDEN PARK reserves the right to take any precautionary measures it deems necessary.

 

10/ MODIFICATIONS TO THE PRESENT CHARTER PERSONAL DATA

In compliance with the law and acquired rights, this Personal Data Charter may be subject to changes, which will take effect on the date of publication of their update.